Security audit

arXiv Explorer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward arXiv search/download helper, with some quality and transport-security issues but no evidence of hidden, destructive, persistent, or credential-seeking behavior.

Install only if you are comfortable with a simple arXiv helper that makes network requests and writes PDFs where you ask it to. Prefer using it on trusted networks until the API endpoint is changed to HTTPS and remote text is sanitized before terminal display; ignore the donation QR content if it is not relevant to you.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/arxiv-explorer.py:16
Finding: Cleartext arXiv API Transport Enables Response Tampering and Terminal Output Injection
Content: View full analysis
3 else ''}", f" Date: {paper['published']} | ID: {paper['id']}", f" PDF: {paper.get('pdf_url', 'N/A')}", f" Summary: {paper['summary'][:200]}..." if len(paper['summary']) > 200 else f" Summary: {paper['summary']}", "" ] return '\n'.join(lines) ``` ### Technical Analysis The arXiv API endpoint uses plain HTTP rather than HTTPS. Consequentl ...[truncated 2819 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code largely matches the declared arXiv exploration purpose: it searches arXiv, retrieves recent papers by category, and downloads PDFs. However, the description overstates two capabilities. First, it claims to summarize academic content, but the code only displays the summary/abstract returned by arXiv and contains no summarization logic. Second, it claims support for searching by authors, categories, and keywords; category browsing is supported through the recent command, but explicit author-targeted search is not implemented—search always uses a generic all-field query. These are meaningful description-to-behavior gaps, though the overall primary purpose is consistent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises network-dependent commands (searching arXiv and downloading PDFs) but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can allow broader network use than reviewers or runtime policy expect, which is a real security governance issue even if the intended function is legitimate.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Embedding an external donation QR code image unrelated to the skill's core function introduces unnecessary third-party content retrieval and a social-engineering surface. While not directly exploitative on its own, it can leak metadata through image fetches, create trust confusion, and normalize off-task financial solicitation inside a functional skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L78 presents the support callout entirely in Chinese, which imposes a specific language in user-facing natural language without opt-in or explanation. This can violate organizational language/locale policy when the rest of the skill is in English and no language choice is offered.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.